Re: interface or source ip match using brouting - transparent proxy

> hi, internally I am using 10/8 ip network and internal bridge card is eth1,
> I am using iptables and ebtables. I want only internal trafic incoming 
> through eth1 to proxy, so I use:
> ebtables -t broute -A BROUTING -p IPv4 -i eth1 --ip-src 10.0.0.0/8 --ip-protocol 6 --ip-destination-port 80 -j redirect --redirect-target ACCEPT

Shouldn't that be -j DROP anyway ?

> but I try to swap cables between eth0 and eth1, and all works the same way,
> even when I change client IP. Once tried match by source MAC, it did not 
> work as well. I tried with ubuntu breezy and 
> now latest dapper wit 2.6.15 kernel. Please advise me if I am doing
> something wrong way or ebtables just does not support that way and I 
> should go other way?

You might want to do the redirect in the FORWARD chain using -m physdev 
--physdev-in. I think that redirecting is actually done after the bridge 
has seen the packets, not before. But Bart might actually answer this one 
:)



	Igmar


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642